Why Firewall Throughput Drops When You Turn Inspection On
The headline throughput figure on a firewall data sheet is measured with inspection switched off. It counts packets the appliance forwards after a rule match and nothing else. Switch on intrusion prevention, application control, malware scanning and TLS decryption, and the same box has to rebuild sessions, read inside payloads, and for encrypted traffic terminate and re-establish every TLS connection. The vendors publish both numbers. Fortinet's FortiGate 90G data sheet, revision R17 dated 9 July 2026, lists 28 Gbps of firewall throughput and 2.2 Gbps of threat protection throughput for the same desktop appliance. That is a factor of about 13 between the number in the headline and the number that describes an office with security features enabled.
Our guide to sizing a firewall for a UAE SME covers which figure to buy against. This article explains why the figures are shaped this way, and the capacity limit that catches Dubai offices out more often than bandwidth does.
Three data sheets, the same pattern
The drop is not a Fortinet quirk. Cisco's Secure Firewall 1200 Series data sheet, updated 9 July 2025, and SonicWall's Gen 7 TZ series data sheet show the same shape on different hardware.
| Appliance | Forwarding only | With inspection | With TLS decryption |
|---|---|---|---|
| FortiGate 90G | 28 Gbps firewall throughput, 1518 byte UDP | 2.2 Gbps threat protection, enterprise traffic mix | 2.6 Gbps SSL inspection, IPS with average HTTPS |
| Cisco Secure Firewall 1230 | 13 Gbps firewall plus application visibility, 1024 byte packets | 9.0 Gbps with intrusion prevention added | 2.5 Gbps TLS decryption |
| SonicWall TZ270 | 2 Gbps firewall inspection throughput | 750 Mbps threat prevention throughput | 300 Mbps TLS and SSL inspection and decryption, DPI SSL |
Read the row labels rather than the numbers and the vendors are being straight with you. Fortinet's footnote 5 says threat protection throughput is measured with firewall, IPS, application control and malware protection enabled, and footnote 2 adds that logging is on during the test. SonicWall's footnote says threat prevention throughput is measured with Gateway Anti-Virus, Anti-Spyware, IPS and Application Control enabled. Cisco's table separates firewall plus application visibility from the same plus intrusion prevention, then puts TLS decryption on its own line. The figures are not comparable between brands, because the feature sets behind each label differ, but within one data sheet the ratio tells you what inspection costs on that hardware.
What the appliance is actually doing differently
Forwarding an established session is a lookup. The appliance matches the five tuple against its session table, rewrites addresses if needed and sends the packet out, which on many platforms is handled by dedicated silicon rather than the main processor. Fortinet builds this into the SP5 ASIC in the 90G, which its data sheet describes as combining a RISC based processor with content and network processors.
Inspection is a different job. The FortiOS 7.6.6 administration guide describes the two ways it can be done: "Flow-based inspection takes a snapshot of content packets and uses pattern matching to identify security threats in the content" while "Proxy-based inspection reconstructs content that passes through the FortiGate and inspects the content for security threats." Pattern matching across a reassembled stream is work the session lookup never had to do, and proxy mode holds content in memory before deciding on it, which is why the same policy in proxy mode costs more than in flow mode on identical hardware.
Decryption adds a third cost. To read inside a TLS session the firewall terminates the client connection with a certificate it signs, then opens its own session to the server, so one user connection becomes two TLS handshakes plus symmetric encryption in both directions. Cisco's technical note 226240, updated 19 August 2026, sets out the result: lower effective throughput, higher latency and increased inspection CPU usage, with a load "that cannot be accurately predicted as a fixed percentage without real traffic profile analysis."
The limit that bites first is connections, not gigabits
This is the part buyers miss, and it sits on the same page of the same data sheets. The FortiGate 90G handles 124,000 new TCP sessions per second and 3 million concurrent sessions. Turn on SSL inspection and the same appliance is rated for 1,400 SSL inspection connections per second and 300,000 concurrent inspected sessions. The connection setup rate falls by roughly 88 times, against about 13 for the throughput figure.
SonicWall publishes the same collapse as three separate rows. A TZ270 supports 750,000 maximum connections with stateful packet inspection, 150,000 with deep packet inspection, and 25,000 with DPI SSL. The TZ470 is rated at 1,000,000, 250,000 and 35,000. Size on the first number and deploy the third, and the appliance runs out of connection slots long before it runs out of bandwidth. The symptom on the floor is pages that hang, not a link that saturates.
There is an arithmetic check worth doing before any purchase. Take the decrypted connection ceiling, divide by the concurrent connections per user your own monitoring shows during a working morning, and compare the answer with your headcount plus phones, cameras and anything else that talks out. Read the connections per user from your current firewall rather than accepting an estimate, because a floor running collaboration tools and a floor running file transfers give very different answers.
Why your traffic will not match any published figure
Every number above comes from a laboratory. RFC 9411, published in March 2023 by authors from EANTC and NetSecOPEN, exists because those laboratories were not testing the same way. It defines inspected throughput as the examined and allowed traffic the device transmits to the correct destination, and it specifies what must be switched on during the test, including logging at flow level, application identification tuned to the traffic mix, and an access control list count matched to the size class of the device. It also fixes the traffic profile, recommending HTTP response object sizes of 1, 16, 64 and 256 KB plus mixed objects, and requires TLS 1.2 or higher with named cipher suites.
Vendor tests sit at different points around that. SonicWall's footnote states the firewall row follows RFC 2544 and the threat prevention rows use Keysight HTTP performance test tools. Fortinet's footnote 3 says SSL inspection values use an average of HTTPS sessions of different cipher suites. Cisco's table warns that "Performance will vary depending on features activated, network traffic protocol mix, and packet size characteristics." Your mix of small transactional requests, video calls and backup traffic is not an averaged object size, so treat the published inspected figure as a ceiling you will not reach rather than a target.
Sizing this against a real Dubai circuit
Business fibre in the UAE has outrun the inspected figures. The e& business internet plans listed on eand.ae run from 200 Mbps for a one user pack to 1 Gbps for a ten user or custom pack. A SonicWall TZ270 inspecting TLS at 300 Mbps sits below a 550 Mbps circuit, so a business in Business Bay that upgrades the line without revisiting the firewall has quietly made the firewall the bottleneck.
Four practical points follow from the numbers above:
- Decide what you will decrypt before you choose a model. Cisco's technical note recommends do not decrypt rules for banking and financial sites, healthcare portals, certificate pinned applications and some SaaS and endpoint security services. The decrypted share of your traffic is therefore a policy decision, and it sets which row of the data sheet applies to you.
- Count traffic that crosses the firewall twice. A hub in DIFC that inspects branch traffic arriving over IPsec from a Jebel Ali warehouse pays the inspection cost for that traffic as well as for its own users. Our article on SD-WAN for multi-site UAE businesses covers where that inspection should sit.
- Keep the VPN line separate in your head. The FortiGate 90G is rated at 25 Gbps of IPsec VPN throughput with 512 byte packets using AES256-SHA256, which is an encryption task the hardware accelerates, and 2.2 Gbps of threat protection, which is an inspection task it does not. The two numbers describe different work and neither predicts the other.
- Assume logging stays on. Fortinet measured the enterprise mix figures with logging enabled, and you will want it enabled for incident response, so that part of the published number already reflects your conditions. Log storage and retention are a separate line to specify, as covered in our note on reading an enterprise hardware quotation line by line.
Questions to put to the vendor before you sign
- Which published row matches the feature set we intend to run, and what is that figure in Gbps for the exact model and software version quoted?
- What is the rated connections per second and concurrent connection count with decryption enabled, not the stateful figure?
- Which traffic categories does the proposed policy exclude from decryption, and what share of our traffic does that leave inspected?
- Does the quoted model use flow based or proxy based inspection for the profiles we need, and what does that change on this hardware?
- What headroom remains at our current circuit speed, and at the next speed tier we are likely to buy?
Where the hardware comes from
Codeeo Tech is a hardware supplier rather than a security integrator, so the policy design and tuning above belong to your team or your consultant. What we supply are the appliances: Cisco Secure Firewall and Firepower units, Fortinet FortiGate platforms, SonicWall appliances and Juniper security hardware. Every item is priced on request. Send the model, the software version and the feature set you plan to run through the contact page and ask for a quotation against that specification, with the subscription term stated alongside the hardware.
Cover photo: Sheikh Zayed Road 10, via Wikimedia Commons (CC0).
